1# Common version number defines for libcap 2LIBTITLE=libcap 3VERSION=2 4MINOR=53 5 6# 7## Optional prefixes: 8# 9 10# common 'packaging' directory 11 12FAKEROOT=$(DESTDIR) 13 14# Autoconf-style prefixes are activated when $(prefix) is defined. 15# Otherwise binaries and libraries are installed in /{lib,sbin}/, 16# header files in /usr/include/ and documentation in /usr/man/man?/. 17# These choices are motivated by the fact that getcap and setcap are 18# administrative operations that could be needed to recover a system. 19 20ifndef lib 21lib=$(shell ldd /usr/bin/ld|egrep "ld-linux|ld.so"|cut -d/ -f2) 22endif 23 24ifdef prefix 25exec_prefix=$(prefix) 26lib_prefix=$(exec_prefix) 27inc_prefix=$(lib_prefix) 28man_prefix=$(prefix)/share 29else 30prefix=/usr 31exec_prefix= 32lib_prefix=$(exec_prefix) 33inc_prefix=$(prefix) 34man_prefix=$(prefix)/share 35endif 36 37# Target directories 38 39MANDIR=$(man_prefix)/man 40SBINDIR=$(exec_prefix)/sbin 41INCDIR=$(inc_prefix)/include 42LIBDIR=$(lib_prefix)/$(lib) 43PKGCONFIGDIR=$(LIBDIR)/pkgconfig 44GOPKGDIR=$(prefix)/share/gocode/src 45 46# From here on out, the Go module packages should always remain 47# backwardly compatible. I will only resort to using major version 2 48# etc if Go's syntax dramatically changes in a backwards incompatible 49# manner. (Let's hope not.) 50GOMAJOR=1 51 52# Compilation specifics 53 54KERNEL_HEADERS := $(topdir)/libcap/include/uapi 55IPATH += -fPIC -I$(KERNEL_HEADERS) -I$(topdir)/libcap/include 56 57CC := $(CROSS_COMPILE)gcc 58DEFINES := -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 59COPTS ?= -O2 60CFLAGS ?= $(COPTS) $(DEFINES) 61BUILD_CC ?= $(CC) 62BUILD_COPTS ?= -O2 63BUILD_CFLAGS ?= $(BUILD_COPTS) $(DEFINES) $(IPATH) 64AR := $(CROSS_COMPILE)ar 65RANLIB := $(CROSS_COMPILE)ranlib 66OBJCOPY := $(CROSS_COMPILE)objcopy 67DEBUG = -g #-DDEBUG 68WARNINGS=-Wall -Wwrite-strings \ 69 -Wpointer-arith -Wcast-qual -Wcast-align \ 70 -Wstrict-prototypes -Wmissing-prototypes \ 71 -Wnested-externs -Winline -Wshadow 72LD=$(CC) -Wl,-x -shared 73LDFLAGS ?= #-g 74LIBCAPLIB := -L$(topdir)/libcap -lcap 75PSXLINKFLAGS := -lpthread -Wl,-wrap,pthread_create 76LIBPSXLIB := -L$(topdir)/libcap -lpsx $(PSXLINKFLAGS) 77 78BUILD_GPERF := $(shell which gperf >/dev/null 2>/dev/null && echo yes) 79 80SYSTEM_HEADERS = /usr/include 81INCS=$(topdir)/libcap/include/sys/capability.h 82CFLAGS += -Dlinux $(WARNINGS) $(DEBUG) 83INDENT := $(shell if [ -n "$$(which indent 2>/dev/null)" ]; then echo "| indent -kr" ; fi) 84 85# SHARED tracks whether or not the SHARED libraries (libcap.so, 86# libpsx.so and pam_cap.so) are built. (Some environments don't 87# support shared libraries.) 88SHARED ?= yes 89# DYNAMIC controls how capsh etc are linked - to shared or static libraries 90DYNAMIC := $(shell if [ ! -d "$(topdir)/.git" ]; then echo $(SHARED); else echo no ; fi) 91 92PAM_CAP ?= $(shell if [ -f /usr/include/security/pam_modules.h ]; then echo $(SHARED) ; else echo no ; fi) 93 94# If your system does not support pthreads, override this as "no". 95# 96# make PTHREADS=no ... 97# 98# This implies no Go support and no C/C++ libpsx build. Why might you 99# need libpsx for non-Go use? Tl;dr for POSIX semantics security: 100# 101# https://sites.google.com/site/fullycapable/who-ordered-libpsx 102# 103PTHREADS ?= yes 104 105ifeq ($(PTHREADS),yes) 106GO ?= go 107GOLANG ?= $(shell if [ -n "$(shell $(GO) version 2>/dev/null)" ]; then echo yes ; else echo no ; fi) 108ifeq ($(GOLANG),yes) 109GOROOT ?= $(shell $(GO) env GOROOT) 110GOCGO ?= $(shell if [ "$(shell $(GO) env CGO_ENABLED)" = 1 ]; then echo yes ; else echo no ; fi) 111GOOSARCH ?= $(shell $(GO) env GOHOSTOS)_$(shell $(GO) env GOHOSTARCH) 112CGO_REQUIRED=$(shell $(topdir)/go/cgo-required.sh $(GO)) 113ifeq ($(CGO_REQUIRED),1) 114# Strictly speaking go1.15 doesn't need this, but 1.16 is when the 115# real golang support arrives for non-cgo support, so drop the last 116# vestige of legacy workarounds then. 117CGO_LDFLAGS_ALLOW := CGO_LDFLAGS_ALLOW="-Wl,-?-wrap[=,][^-.@][^,]*" 118endif 119CGO_CFLAGS := -I$(topdir)/libcap/include 120CGO_LDFLAGS := -L$(topdir)/libcap 121endif 122endif 123 124# If you want capsh to launch with something other than /bin/bash 125# build like this: 126# 127# make CAPSH_SHELL='-DSHELL=\"/bin/sh\"' 128# 129# or undefine the following: 130#CAPSH_SHELL := '-DSHELL="/bin/sh"' 131 132# When installing setcap, you can arrange for the installation process 133# to set its inheritable bit to be able to place capabilities on files. 134# It can be used in conjunction with pam_cap (associated with su and 135# certain users say) to make it useful for specially blessed users. 136# 137# make RAISE_SETFCAP=yes install 138# 139# This is now defaulted to no because some distributions have started 140# shipping with all users blessed with full inheritable sets which makes 141# no sense whatsoever! 142# 143# Indeed, it looks alarmingly like these distributions are recreating 144# the environment for what became known as the sendmail-capabilities 145# bug from 2000: 146# 147# https://sites.google.com/site/fullycapable/Home/thesendmailcapabilitiesissue 148# 149# they are also nullifying the difference between a p-bit and an i-bit. 150# 151# Folk really should read this document, which explains there is a really 152# important difference being lost here: 153# 154# https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/33528.pdf 155# 156# In the context of this tree, on such such systems, a yes setting will 157# guarantee that every user, by default, is able to bless any binary with 158# any capability - a ready made local exploit mechanism. 159RAISE_SETFCAP := no 160 161# If set to yes, this will cause the go "web" demo app to force the needed p 162# bit to be able to bind to port 80 without running as root. 163RAISE_GO_FILECAP := no 164 165# Global cleanup stuff 166 167LOCALCLEAN=rm -f *~ core 168DISTCLEAN=@find . \( -name '*.orig' -o -name '*.rej' \) | xargs rm -f 169